alternate attributeSourceIDs for a given nameid format

[Baron Fujimoto]

Thanks for the suggestion. Upon consideration, I don't think this will work
as is. The problem is that I believe the SP in question (SAP Concur) will
uses the same entityID for both instances, so I don't think it's we can use
it to distinguish between the two instances for the activation condition.
Upon further reflection, I'm not sure how we're supposed to be able
distinguish between their instances without something like an entityID
difference. But maybe I'm missing something else.



On Thu, Mar 4, 2021 at 4:45 PM Lipscomb, Gary via users <
users at shibboleth.net> wrote:

> Try something like this
>
>
>
>   <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>
>
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>
>             p:attributeSourceIds="#{ {'attrEmail_real'} }">
>
>         <property name="activationCondition">
>
>                 <bean parent="shibboleth.Conditions.RelyingPartyId"
> c:candidates="#{{SP entityID}}" />
>
>          </property>
>
> </bean>
>
>
>
> Gary
>
>
>
> *From:* users <users-bounces at shibboleth.net> *On Behalf Of *Baron Fujimoto
> *Sent:* Friday, 5 March 2021 13:20
> *To:* Shib Users <users at shibboleth.net>
> *Subject:* alternate attributeSourceIDs for a given nameid format
>
>
>
> We have an SP that claims to need an emailAddress NameIDFormat. We can
> currently achieve this with an entry in our saml-nameid.xml conf file like:
>
>
>
>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>
>
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>
>             p:attributeSourceIds="#{ {'attrEmail_real'} }" />
>
>
>
> However, for this SP now claims that for a separate instance of their SP,
> they need users with IDs that do not share the same domain name. We may be
> able to synthesize a new email-like attribute, say, attrEmail_2, but is
> there a way to get use it as an alternate emailAddress NameIDFormat for
> this just this SP? E.g, something like
>
>
>
>         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>
>
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>
>             p:attributeSourceIds="#{ {'attrEmail_synth'} }" />
>
>
>
> It seems like the nameid encoder(?) only pays attention to the format
> though, and not the attributeSourceId, and thus select one or other?
>
>
>
> Perhaps some approach using an activation condition, or other suggestions
> or advice?
>
>
>
> --
>
> Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
> minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210309/31631cc8/attachment.htm>